OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ | 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ |
6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ | 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ |
7 | 7 |
8 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 8 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h" |
| 9 #include "sandbox/linux/bpf_dsl/policy.h" |
9 #include "sandbox/sandbox_export.h" | 10 #include "sandbox/sandbox_export.h" |
10 | 11 |
11 namespace sandbox { | 12 namespace sandbox { |
12 | 13 |
13 // This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox | 14 // This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox |
14 // that reduces the Linux kernel's attack surface. Given its nature, it doesn't | 15 // that reduces the Linux kernel's attack surface. Given its nature, it doesn't |
15 // have a clear semantics and is mostly "implementation-defined". | 16 // have a clear semantics and is mostly "implementation-defined". |
16 // | 17 // |
17 // This class implements the SandboxBPFDSLPolicy interface with a "baseline" | 18 // This class implements the Policy interface with a "baseline" |
18 // policy for use within Chromium. | 19 // policy for use within Chromium. |
19 // The "baseline" policy is somewhat arbitrary. All Chromium policies are an | 20 // The "baseline" policy is somewhat arbitrary. All Chromium policies are an |
20 // alteration of it, and it represents a reasonable common ground to run most | 21 // alteration of it, and it represents a reasonable common ground to run most |
21 // code in a sandboxed environment. | 22 // code in a sandboxed environment. |
22 // A baseline policy is only valid for the process for which this object was | 23 // A baseline policy is only valid for the process for which this object was |
23 // instantiated (so do not fork() and use it in a child). | 24 // instantiated (so do not fork() and use it in a child). |
24 class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::SandboxBPFDSLPolicy { | 25 class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::Policy { |
25 public: | 26 public: |
26 BaselinePolicy(); | 27 BaselinePolicy(); |
27 // |fs_denied_errno| is the errno returned when a filesystem access system | 28 // |fs_denied_errno| is the errno returned when a filesystem access system |
28 // call is denied. | 29 // call is denied. |
29 explicit BaselinePolicy(int fs_denied_errno); | 30 explicit BaselinePolicy(int fs_denied_errno); |
30 virtual ~BaselinePolicy(); | 31 virtual ~BaselinePolicy(); |
31 | 32 |
32 virtual bpf_dsl::ResultExpr EvaluateSyscall( | 33 virtual bpf_dsl::ResultExpr EvaluateSyscall( |
33 int system_call_number) const override; | 34 int system_call_number) const override; |
34 virtual bpf_dsl::ResultExpr InvalidSyscall() const override; | 35 virtual bpf_dsl::ResultExpr InvalidSyscall() const override; |
35 pid_t policy_pid() const { return policy_pid_; } | 36 pid_t policy_pid() const { return policy_pid_; } |
36 | 37 |
37 private: | 38 private: |
38 int fs_denied_errno_; | 39 int fs_denied_errno_; |
39 | 40 |
40 // The PID that the policy applies to (should be equal to the current pid). | 41 // The PID that the policy applies to (should be equal to the current pid). |
41 pid_t policy_pid_; | 42 pid_t policy_pid_; |
42 | 43 |
43 DISALLOW_COPY_AND_ASSIGN(BaselinePolicy); | 44 DISALLOW_COPY_AND_ASSIGN(BaselinePolicy); |
44 }; | 45 }; |
45 | 46 |
46 } // namespace sandbox. | 47 } // namespace sandbox. |
47 | 48 |
48 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ | 49 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ |
OLD | NEW |